windows-itpro-docs/windows/security/threat-protection/auditing/audit-directory-service-replication.md

title, description, ms.assetid, ms.reviewer, manager, ms.author, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, ms.localizationpriority, author, ms.date, ms.technology

title	description	ms.assetid	ms.reviewer	manager	ms.author	ms.pagetype	ms.prod	ms.mktglfcycl	ms.sitesec	ms.localizationpriority	author	ms.date	ms.technology
Audit Directory Service Replication (Windows 10)	Audit Directory Service Replication is a policy setting that decides if audit events are created when replication between two domain controllers begins or ends.	b95d296c-7993-4e8d-8064-a8bbe284bd56		dansimp	dansimp	security	m365-security	deploy	library	none	dansimp	09/06/2021	windows-sec

Audit Directory Service Replication

Audit Directory Service Replication determines whether the operating system generates audit events when replication between two domain controllers begins and ends.

Event volume: Medium on domain controllers.

Computer Type	General Success	General Failure	Stronger Success	Stronger Failure	Comments
Domain Controller	No	No	IF	IF	IF - Events in this subcategory typically have an informational purpose and it is difficult to detect any malicious activity using these events. It’s mainly used for Active Directory replication troubleshooting.
Member Server	No	No	No	No	This subcategory makes sense only on domain controllers.
Workstation	No	No	No	No	This subcategory makes sense only on domain controllers.

Events List:

• 4932(S): Synchronization of a replica of an Active Directory naming context has begun.

• 4933(S, F): Synchronization of a replica of an Active Directory naming context has ended.